Last updated: 21 August 2026.
La Vida Ventures Ltd, a company registered in England & Wales (company number 17368286), registered office 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE, trading as FreeholdMate, is the data controller for the personal data described below. You can contact us about anything in this policy at [email protected].
Our ICO data protection registration reference is ZC224240 — verify it on the public register.
Account data. Your name, email address, and a hashed (never plaintext) password. If you're invited to a company by someone else, we also record who invited you and when you accepted.
Company data. Directors, people with significant control (PSCs) and their correspondence addresses, read from the public Companies House register when you connect a company — plus whatever you enter yourself: members and shareholders, unit numbers, share counts, dates of birth, residential and service addresses, share transfers, and the registered and reminder email addresses you set. Some of this (dates of birth, residential addresses) is information Companies House itself never publishes; we hold it because its electronic filing schemas require it.
Documents. Anything you upload — leases, insurance certificates, minutes, accounts, notices — stored in our database rather than on a separate file service.
"Ask AI" content. If you use this feature, the document you're asking about and your question are sent to our AI provider (see section 4), and the question and answer are saved against that document as a history you can re-read.
Billing data. If you subscribe, Stripe handles the payment and we store only your Stripe customer reference, your subscription status, and the current billing period. We never see or store your card details.
Companies House connection. If a director connects their own Companies House account to authorise certain filings, we store the resulting access and refresh tokens, encrypted at rest. These let us act only on the specific filings you approve, and only for the company they were granted for.
Address lookups. When you use the postcode search in our forms, the partial address you type is sent to our address-lookup provider to return matching addresses. We don't keep a record of what you searched for.
Pre-launch mailing list data (historic). The pre-launch mailing list is closed and no longer collects anything. For anyone who joined it before it closed we still hold: their email address, the fact and time they ticked the consent box, and — only if present — which marketing link or search result brought them here.
Free compliance-check data. If you use the free company-lookup tool on our homepage, we record which company was looked up and the result. Nothing about that identifies you unless you choose to enter your email address to have the result sent to you. We also keep a salted, one-way hash of the originating IP address so we can spot obvious repeat lookups; it cannot be turned back into the original address.
Product analytics. If — and only if — you accept analytics cookies, we record which things happen in the app (a check started, a result shown, a filing submitted) so we can tell whether the product is useful and whether a change we made helped. These events are tied to your account, and your name and email address are attached to it, so this is a record of what your account did rather than an anonymous tally. It's used to understand and improve the product; we don't sell it, we don't build advertising profiles, and we don't share it for anyone else's marketing. It's handled by PostHog on EU servers (see section 4), and choosing "Necessary only" means none of it runs at all.
Technical data. A session cookie and a CSRF token, both strictly functional — keeping you logged in, and protecting against forged form submissions. We also use PostHog, a product analytics provider, to understand how the site is used — but only once you've said yes to it via the cookie banner on your first visit; nothing analytics-related runs or is set before then, and choosing "Necessary only" means it never runs at all. See our Cookie Policy for the full detail, including exactly which cookies that involves. We load no advertising or retargeting scripts, we build no advertising profiles, and we sell nothing to anyone. Fonts are served from Google Fonts, which means your browser contacts Google's servers directly to fetch them.
Most of it is performance of our contract with you: running your account, holding your registers, preparing and submitting the filings you approve, sending deadline reminders, and taking payment.
Some relies on our legitimate interests — keeping the Service secure (session and rate-limiting data, the hashed IP on the free tool), understanding whether the product is useful (aggregate counts), and defending or establishing legal claims. In each case we've weighed that interest against your rights and kept the processing to what's necessary for it.
Marketing emails, including anything sent to the closed pre-launch mailing list, rely on your consent. The box was never pre-ticked, and every such email carries a one-click unsubscribe — withdrawing consent is never harder than giving it.
Where we're required to retain records for tax or accounting purposes, that's a legal obligation.
We don't sell your data, and we don't share it for anyone else's marketing. It goes only to the specific providers that make the Service work, each acting on our instructions under a data processing agreement:
We may also disclose data where we're legally required to, or to establish or defend legal claims. If FreeholdMate is ever sold or transferred, your data may transfer with it — we'd tell you before that happened, and this policy would continue to apply until you were given notice of any change.
Your data is hosted in the UK (Fly.io's London region). Some of the providers listed above are based outside the UK, principally in the United States, so using those features involves transferring personal data abroad. Our analytics provider (PostHog) is on EU servers, which the UK recognises as offering equivalent protection.
Where that happens, the transfer is made under the safeguards in each provider's published data protection terms — in practice either the ICO's International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or, where the provider is certified under the EU-US Data Privacy Framework, the UK Extension to that framework (the "UK-US Data Bridge"). Each of those is a recognised safeguard under Article 46 of the UK GDPR, intended to give your data broadly the protection it would have had if it had never left the UK.
The practical thing worth knowing: the only feature that sends your document contents abroad is "Ask AI", and only when you choose to use it. Everything else that leaves the UK is limited to email addresses, names, and payment references.
Account and company data is kept for as long as your account is open. When a company is removed, its registers, documents, activity log, filing history and access records are deleted immediately and permanently from our live systems — there is no recovery, which is why removal asks you to type the company's name to confirm and offers you a full export first.
Backups. Deleted data can persist in our encrypted rolling backups for a short period after deletion. Backups roll over continuously and anything deleted falls out of them within 30 days.
Billing records are kept for six years after the end of the relevant financial year, as UK tax law requires.
Pre-launch mailing list entries are kept until you sign up for an account or unsubscribe, whichever comes first. The list itself is closed to new entries.
Free compliance-check records are kept while that tool is running so we can understand how it's used. The IP hash is one-way and can't be reversed to identify you. If you gave us an email address to receive a result, you can ask us to delete that record at any time.
Uploaded documents, correspondence addresses, registered and reminder email addresses, reminder-history recipients, "Ask AI" question history, and Companies House access tokens are all encrypted at rest with AES-256-GCM. Data in transit is encrypted with HTTPS. Passwords are hashed with scrypt and never stored in a form we could read.
Some fields are deliberately not encrypted, and it's fair for you to know which: directors' and members' names, company numbers, share counts, and your login email address. Names and company numbers are already public record via Companies House itself, and the login email has to be queryable for authentication to work at all.
No system is perfectly secure. If we ever suffer a breach that's likely to result in a risk to your rights, we'll report it to the ICO within 72 hours and tell you directly where the law requires it — and where it doesn't but you'd obviously want to know, we'll tell you anyway.
Under UK GDPR you have the right to access your personal data, correct it, have it deleted, restrict or object to how we use it, receive it in a portable form, and withdraw consent where consent is what we relied on.
Some of these you can exercise yourself, without asking: export your registers as CSV from the Registers page at any time, download everything as a ZIP before removing a company, correct your own details in the app, and unsubscribe from any marketing email with one click.
For anything else, email [email protected]. We'll respond within one month, as the law requires, and we won't charge you for it. If you're not happy with how we've handled something, you can complain to the Information Commissioner's Office — though we'd appreciate the chance to put it right first.
The Service is for company directors and officers acting in a business capacity. It isn't intended for children, and we don't knowingly collect data from anyone under 18.
We may update this policy from time to time. If we make a material change, we'll email you and show an in-app notice before it takes effect. The date at the top of this page always reflects the current version.
Any question about your data, or any request under section 8: [email protected].